Full Disclosure mailing list archives
Re: Re: [VulnDiscuss] Re: [VulnWatch] TCP Reset Attacks: Paper and Code Now Availble
From: <id3nt () hush com>
Date: Fri, 23 Apr 2004 07:35:41 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Crisco is a marketting machine and nothing more. We spent 12 years supporting them and at every turn were told lies about the product, new product and their vaporware. But management was getting huge perks for doing business with them. Do a comparison of Crisco and other network vendors on S-Focus for bugs, vulns and otherwise lame stuff. Then, armed with this info, take it to your manager whose getting the free golf trip to barbados and say, I can't work with this stuff; it's to buggy. On Fri, 23 Apr 2004 06:14:53 -0700 Florian Weimer <Weimer () CERT Uni-Stuttgart DE> wrote:
Kurt Seifried wrote:Please note: According to the Cisco presentation afterwards, Cisco's RST behaviormakesit non vulnerable as there is a wait period after a certain numberof badRST packets are recieved. Thus Cisco IOS is basically not affected.This is not quite true according to the advisiories. You flood the other side with SYN segments (which are NOT rate limited). Only if the segment number is acceptable, the other side generates an RST segment which tears down the connection. RST rate limits do NOT help here. Even if you drop RST segments completely, the other side probably makes a state transition away from ESTABLISHED so that connection is eventually broken (I haven't tested this, but it's required according to RFC 793). The SYN issue is not present in the Watson's paper, by the way. I don't know how he was able to attack those TCP connections with RST segments. Probably he didn't test an IOS-to-IOS TCP connection. -- Florian Weimer Weimer () CERT Uni-Stuttgart DE University of Stuttgart ZENDAS fax +49-711-121-3688 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkCJKbUACgkQIgPmhDwqbfRHiwCdEQGfBo0+huuAUnntouRsYimOZ18A oLf9/unkzoUkHg/hy/tQLpR+Jxqk =kJu2 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Re: [VulnDiscuss] Re: [VulnWatch] TCP Reset Attacks: Paper and Code Now Availble id3nt (Apr 23)